Skip to content

I run a small business. When am I required to follow the Privacy Act?

In general, most small businesses will not be required to follow the regulations of the Privacy Act 1988 (the Act). There are, however, some exceptions to the rule. For example, a small business that generates revenue of $3M or less annually will be required to follow the rules and regulations of the Act if it is:

  • A health service provider;
  • Trading personal information, such as mailing lists;
  • A contractor who provides a service under a Commonwealth contract;
  • A ‘reporting entity’ as per the Anti-Money Laundering and Counter-Terrorism Financing Act 2006;
  • Operating a residential tenancy database;
  • An employee association recognised by the Fair Work (Registered Organisations) Act 2009;
  • A business that is related to another business that is captured by the Act;
  • A business that has opted to be covered by the Act

If your business falls into one of the above categories and turns over $3M or less, then the provisions of the Act will apply and you will be required to comply with the regulations of the Act.

Your business, if covered by the provisions of the Act, will have to comply with the Australian Privacy Principles (APPs).

What is the meaning of ‘trading in personal information’?

The idea of ‘trading in’ personal information relates to businesses that gather someone’s personal information from, or share someone’s personal information with, another person or business for some service, benefit or advantage. This can be in the form of a subsidy, a concession, etc. If you are unsure whether this applies to your business, speak with an experienced business lawyer.

If you buy, sell or barter personal information, it is likely that you are ‘trading’ in personal information. For instance, if someone offers to sell you a mailing list and you choose not to get the consent of the individuals on that list, you may be trading in personal information. Or, alternatively, if you share the details of clients with another individual or business to get a commercial benefit, this type of conduct may also constitute trading in personal information.

However, if a business discloses or becomes privy to personal information for some advantage, service or benefit, it will not be trading in personal information if the individuals have given their consent. Alternatively, if the law requires the business to collect or disclose personal information, it will also be exempt.

Any business trading in personal information will be required to strictly comply with the APPs of Act. Although adherence to the APPs does not prevent a business from collecting personal information generally, it does impose rules and guidelines as to the manner in which that information is dealt with.

Here is a useful Guide to privacy for small business and the APP guidelines.

What constitutes ‘consent’ of an individual?

Any business that buys or sells personal information and does not want to have to abide by the APPs will need to collect each individual’s consent before they make the purchase or complete the sale. Consent can come in various forms, so for further clarification you should speak with an experienced business lawyer.

Continue reading this article below the form
Loading form

Conclusion

As a small business owner, you need to stay aware of any changes in Australian Privacy law so that you do not accidently breach any of the applicable APPs. Contact your business lawyer or speak with an experienced business lawyer at LegalVision to get a fixed-fee quote for advice.

 

Register for our free webinars

ACCC Merger Reforms: Key Takeaways for Executives and Legal Counsel

Online
Understand how the ACCC’s merger reforms impact your legal strategy. Register for our free webinar.
Register Now

Ask an Employment Lawyer: Contracts, Performance and Navigating Dismissals

Online
Ask an employment lawyer your contract, performance and dismissal questions in our free webinar. Register today.
Register Now

Stop Chasing Unpaid Invoices: Payment Terms That Actually Work

Online
Stop chasing late payments with stronger terms and protections. Register for our free webinar.
Register Now

Managing Psychosocial Risks: Employer and Legal Counsel Responsibilities

Online
Protect your business by managing workplace psychosocial risks. Register for our free webinar.
Register Now
See more webinars >
Lachlan McKnight

Lachlan McKnight

CEO | View profile

Lachlan is the CEO of LegalVision. He co-founded LegalVision in 2012 with the goal of providing high quality, cost effective legal services at scale to both SMEs and large corporates.

Qualifications: Lachlan has an MBA from INSEAD and is admitted to the Supreme Court of England and Wales and the Supreme Court of New South Wales.

Read all articles by Lachlan

About LegalVision

LegalVision is an innovative commercial law firm that provides businesses with affordable, unlimited and ongoing legal assistance through our membership. We operate in Australia, the United Kingdom and New Zealand.

Learn more

We’re an award-winning law firm

  • Award

    2025 Future of Legal Services Innovation Finalist - Legal Innovation Awards

  • Award

    2025 Employer of Choice - Australasian Lawyer

  • Award

    2024 Law Company of the Year Finalist - The Lawyer Awards

  • Award

    2024 Law Firm of the Year Finalist - Modern Law Private Client Awards

  • Award

    2022 Law Firm of the Year - Australasian Law Awards